Juniper ATP: Password hashing uses DES and a hardcoded salt
CVE-2019-0030

6.7MEDIUM

Key Information:

Vendor
Juniper Networks
Status
Juniper Atp
Vendor
CVE Published:
15 January 2019

Badges

👾 Exploit Exists

Summary

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

Affected Version(s)

Juniper ATP 5.0 < 5.0.3

References

https://kb.juniper.net/JSA10918
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.